# Fastify denial-of-service vulnerability with large JSON payloads

Fastify <=0.37.0 buffered unbounded JSON request bodies into a string, so a 1GB+ payload crashed the Node process via V8 string limit or OOM.

- Payout: hidden
- Severity: critical
- Program: Node.js third-party modules
- Found by: nwoltman
- Disclosed: 2018-01-25
- CVE: CVE-2018-3711
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/303632
- Library page: https://bugbountylibrary.com/r/h1%3A303632
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:critical tech:nodejs technique:source-review vuln:dos

**Target:** Fastify HTTP server JSON body parser
**Root cause:** Fastify accumulated the entire request payload into a string and JSON-parsed it only after full receipt, with no size limit before parsing, so oversized bodies exceeded V8's max string length or process memory.
**Steps:**
1. Create a Fastify server with a POST route, e.g. `fastify.post('/*', async () => 'response text')`, and start it.
2. Send a POST with `Content-Type: application/json` and a payload of 1GB or larger (may be streamed).
3. Payload exceeds V8 string limit (`2^30 - 25` bytes on V8 62/Node 9, `2^28 - 16` earlier) or process memory, crashing the process with an uncaughtException before the request completes.
4. Repeat or parallelize a few requests to exhaust memory faster.
**How found:** Code review of lib/handleRequest.js showed the payload built as a string and JSON-parsed only after full receipt, with no pre-parse size cap; reasoning about V8 string length limits and process memory identified the crash threshold.
**Exploitation:** Attacker streams a very large application/json body (e.g. 20000 x 100KB buffers via Node http.request) to a Fastify endpoint; the server buffers it into a string until V8's string limit or memory is exceeded, crashing the process. Repeatable indefinitely for persistent DoS.
**Insight:** When auditing Node frameworks, check whether body parsing buffers the full payload into a string before any size limit; V8's max string length (~2^30 bytes) and process memory are hard crash ceilings reachable without a reverse proxy.